FIX: Allow user to recover/delete post if they can review the topic (#10273)

To reproduce the initial issue here:

1. A user makes a post, which discourse-akismet marks as spam (I cheated and called `DiscourseAkismet::PostsBouncer.new.send(:mark_as_spam, post)` for this)
2. The post lands in the review queue
3. The category the topic is in has a `reviewable_by_group_id`
4. A user in that group goes and looks at the Review queue, decides the post is not spam, and clicks Not Spam
5. Weird stuff happens because the `PostDestroyer#recover` method didn't handle this (the user who clicked Not Spam was not the owner of the post and was not a staff member, so the post didn't get un-destroyed and post counts didn't get updated)

Now users who belong to a group who can review a category now have the ability to recover/delete posts fully.
This commit is contained in:
Martin Brennan
2020-07-22 11:57:16 +10:00
committed by GitHub
parent 16961dee76
commit 93a8e34f47
2 changed files with 95 additions and 2 deletions

View File

@@ -65,7 +65,7 @@ class PostDestroyer
delete_removed_posts_after = @opts[:delete_removed_posts_after] || SiteSetting.delete_removed_posts_after
if @user.staff? || delete_removed_posts_after < 1
if @user.staff? || delete_removed_posts_after < 1 || post_is_reviewable?
perform_delete
elsif @user.id == @post.user_id
mark_for_deletion(delete_removed_posts_after)
@@ -85,7 +85,7 @@ class PostDestroyer
end
def recover
if @user.staff? && @post.deleted_at
if (@user.staff? || post_is_reviewable?) && @post.deleted_at
staff_recovered
elsif @user.staff? || @user.id == @post.user_id
user_recovered
@@ -213,6 +213,10 @@ class PostDestroyer
private
def post_is_reviewable?
Guardian.new(@user).can_review_topic?(@post.topic) && Reviewable.exists?(target: @post)
end
# we need topics to change if ever a post in them is deleted or created
# this ensures users relying on this information can keep unread tracking
# working as desired